2024 Arup — deepfake video-call fraud drained HK$200M (about US$25.6M) in 15 transfers

Company-confirmed AI-enabled fraud — British engineering group Arup confirmed in May 2024 that it was the multinational whose Hong Kong finance employee was tricked into transferring HK$200 million (about US$25.6M) by an AI-generated video conference. Hong Kong police described the sequence at a February 2, 2024 briefing: the employee received a message purportedly from the group’s UK-based chief financial officer about a confidential transaction, initially suspected phishing, then joined a video call where the CFO and several other recognisable colleagues appeared and spoke — all of them synthetic recreations built from existing footage. Reassured, the employee authorised 15 transactions to five local bank accounts. Arup said it had notified police at the beginning of the year, confirmed that fake voices and images were used, and stated its financial stability and business operations were not affected; global CIO Rob Greig said the firm faces frequent attacks including deepfakes and hoped disclosure would raise awareness. No personal data was exposed, so recordsAffected stays 0. Catalogued as the benchmark case for generative-AI social engineering, and still the most expensive publicly confirmed deepfake fraud against a named company.